diff --git a/src/helpers.ts b/src/helpers.ts
index be4392d..87793e4 100644
--- a/src/helpers.ts
+++ b/src/helpers.ts
@@ -325,22 +325,38 @@ export async function analyzeContainerLogs(
   const patterns = severityLevels[severity] ?? severityLevels["error"];
   const regex = new RegExp(`(${patterns.join("|")})`, "i");
 
-  let logCmd = `logs --timestamps --since ${since} --tail ${scanTail}`;
-  if (container) logCmd += ` ${container}`;
-  const raw = await dockerExec(logCmd, 120);
-  const lines = raw.split("\n");
+  // Ziel-Container: einzelner Container oder alle laufenden
+  let targets: string[];
+  if (container) {
+    targets = [container];
+  } else {
+    const psRaw = await dockerExec("ps --format '{{.Names}}'", 30);
+    targets = psRaw
+      .split("\n")
+      .map((l) => l.trim())
+      .filter((l) => l.length > 0);
+  }
 
-  const matches: { pattern: string; line: string }[] = [];
+  const matches: { pattern: string; line: string; container: string }[] = [];
   const counts: Record<string, number> = {};
-  for (const line of lines) {
-    const m = line.match(regex);
-    if (m) {
-      const key = m[1].toLowerCase();
-      counts[key] = (counts[key] ?? 0) + 1;
-      if (matches.length < maxResults) {
-        matches.push({ pattern: m[1], line: line.trim().slice(0, 300) });
+  const containersWithMatches: Record<string, number> = {};
+
+  for (const name of targets) {
+    const logCmd = `logs --timestamps --since ${since} --tail ${scanTail} ${name}`;
+    const raw = await dockerExec(logCmd, 120);
+    let containerMatches = 0;
+    for (const line of raw.split("\n")) {
+      const m = line.match(regex);
+      if (m) {
+        const key = m[1].toLowerCase();
+        counts[key] = (counts[key] ?? 0) + 1;
+        containerMatches++;
+        if (matches.length < maxResults) {
+          matches.push({ pattern: m[1], line: line.trim().slice(0, 300), container: name });
+        }
       }
     }
+    if (containerMatches > 0) containersWithMatches[name] = containerMatches;
   }
 
   return JSON.stringify({
@@ -351,6 +367,7 @@ export async function analyzeContainerLogs(
     scan_tail: scanTail,
     total_matches: Object.values(counts).reduce((a, b) => a + b, 0),
     pattern_counts: counts,
+    containers_with_matches: containersWithMatches,
     sample_matches: matches,
   });
 }
diff --git a/src/tools.ts b/src/tools.ts
index b39b595..5d17401 100644
--- a/src/tools.ts
+++ b/src/tools.ts
@@ -85,7 +85,7 @@ export const TOOLS: ToolDef[] = [
           enum: ["error", "warn", "info"],
           description: "Log severity to scan for",
         },
-        container: str("Container name (optional, scans all if omitted)"),
+        container: str("Container name (optional, scans all running containers if omitted)"),
         since: str("Time filter (default 24h)"),
         scan_tail: int("Max lines to scan (default 1000)"),
         max_results: int("Max sample matches (default 50)"),